Anomalous Payload-Based Worm Detection and Signature Generation

By Ke Wang, Gabriela F. Cretu-Ciocarlie, Salvatore J. Stolfo. 2005

311 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Security analysis of online centroid anomaly detection (2010, methodology): “Centroid anomaly detection has been previously used in several intrusion detection systems (e.g., Hofmeyr et al., 1998; Lazarevic et al., 2003; Wang and Stolfo, 2004; Laskov et al., 2004b; Wang et al., 2005; Rieck and Laskov, 2006; Wang et al., 2006; Rieck and Laskov, 2007).”
Adaptive Anomaly Detection via Self-calibration and Dynamic Updating (2009, background): “Payl [29] has a calibration phase for which a sample of test data is measured against the centroids and an initial threshold setting is chosen.”
Limits of Learning-based Signature Generation with Adversaries (2008, background): “Specifically, note differences in their dependence on k, the size of the reflecting set: Theorems 4.1 and 4.2 have a logarithmic dependence on k, while Theorems 4.3 and 4.4 have a polynomial dependence on k.”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, background): “For example, PAYL [35, 36] extracts 256 features from the payload.”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, methodology): “A number of machine learning models, including Support Vector Machines (SVM) [117], Hidden Markov Models (HMM) [34], N-grams [162], Decision Trees [96], Artificial Neural Networks [47] have been successfully applied for solving different intrusion detection tasks.”
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems (2006, methodology): “Accuracy and hardness of evasion are obtained by constructing our anomaly-based IDS using an ensemble of one-class SVM classifiers that work on different feature spaces.”
Behavioral detection of malware on mobile handsets (2008, background): “Furthermore, signature-based detection can be evaded by simple obfuscation, polymorphism and packing techniques [34, 36], thus requiring a new signature for almost every single malware variant.”
Language models for detection of unknown attacks in network traffic (2007, methodology): “Application of n-gram models for network-based IDS originated in the idea of using byte (1-gram) histograms of packet payloads for statistical tests of abnormality [8,13,18].”
Allergy Attack Against Automatic Signature Generation (2006, methodology): “Among the proposed ASG systems, many employ simple byte sequence(s) as signatures [4,5,7,8,11,13,14].”
A survey of multiple classifier systems as hybrid systems (2014, background): “Clustering of ngrams is performed to obtain a model of the normal communication behavior which is accurate allowing zero-day detection of worm infection even in the case of low payload or slow penetration [185].”
Casting out Demons: Sanitizing Training Data for Anomaly Sensors (2008, methodology): “When using Payl, the granularity of three hours again performs the best, given the two threshold bounds 0.15 and 0.55.”
Detecting Unknown Network Attacks Using Language Models (2006, methodology): “Recently, techniques of anomaly-based network intrusion detection have been proposed that analyze packet and connection payloads (11; 16; 17; 18; 10; 9).”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “As discussed in [47, 18, 31], a generic n-gram version of PAYL may help to improve accuracy and the hardness of evasion.”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “The attack is shown to be able to successfully evade the IDS.”
On the infeasibility of modeling polymorphic shellcode (2007, methodology): “a signature from the actual exploit code [24, 43, 25] or stati tical measures of packet content [41, 40, 28], including content c aptured by honeypots [44].”